PYSEC-2026-909
Vulnerability from pysec - Published: 2026-07-07 10:17 - Updated: 2026-07-07 11:31
VLAI
Details
An exponential ReDoS (Regular Expression Denial of Service) can be triggered in the pymatgen PyPI package, when an attacker is able to supply arbitrary input to the GaussianInput.from_string method.
Severity
5.9 (Medium)
Impacted products
| Name | purl | pymatgen | pkg:pypi/pymatgen |
|---|
Aliases
{
"affected": [
{
"package": {
"ecosystem": "PyPI",
"name": "pymatgen",
"purl": "pkg:pypi/pymatgen"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "2025.10.7"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"1.0.4",
"1.0.5",
"1.1.0",
"1.1.1",
"1.1.2",
"1.2.0",
"1.2.1",
"1.2.2",
"1.2.3",
"1.2.4",
"1.2.8",
"1.2.9",
"1.5.0",
"1.6.0",
"1.7.0",
"1.7.2",
"1.8.0",
"1.8.2",
"1.8.3",
"1.9.0",
"2.0.0",
"2.1.0",
"2.1.2",
"2.10.0",
"2.10.1",
"2.10.2",
"2.10.3",
"2.10.4",
"2.10.5",
"2.10.6",
"2.2.0",
"2.2.1",
"2.2.2",
"2.2.3",
"2.2.4",
"2.2.6",
"2.3.0",
"2.3.1",
"2.3.2",
"2.4.0",
"2.4.1",
"2.4.2",
"2.4.3",
"2.5.0",
"2.5.1",
"2.5.2",
"2.5.3",
"2.5.4",
"2.5.5",
"2.6.1",
"2.6.2",
"2.6.3",
"2.6.4",
"2.6.5",
"2.6.6",
"2.7.0",
"2.7.1",
"2.7.2b",
"2.7.3",
"2.7.4",
"2.7.5",
"2.7.6",
"2.7.7",
"2.7.8",
"2.7.9",
"2.8.0",
"2.8.1",
"2.8.10",
"2.8.2",
"2.8.3",
"2.8.5",
"2.8.6",
"2.8.7",
"2.8.8",
"2.8.9",
"2.9.0",
"2.9.1",
"2.9.10",
"2.9.11",
"2.9.12",
"2.9.13",
"2.9.14",
"2.9.2",
"2.9.3",
"2.9.4",
"2.9.5",
"2.9.6",
"2.9.7",
"2.9.8",
"2.9.9",
"2017.10.16",
"2017.11.27",
"2017.11.30",
"2017.11.6",
"2017.11.9",
"2017.12.15",
"2017.12.16",
"2017.12.30",
"2017.12.6",
"2017.12.8",
"2017.6.22",
"2017.6.24",
"2017.6.8",
"2017.7.21",
"2017.7.4",
"2017.8.14",
"2017.8.16",
"2017.8.20",
"2017.8.21",
"2017.8.4",
"2017.9.1",
"2017.9.23",
"2017.9.3",
"2018.1.19",
"2018.1.29",
"2018.10.18",
"2018.11.30",
"2018.11.6",
"2018.12.12",
"2018.2.13",
"2018.3.13",
"2018.3.14",
"2018.3.2",
"2018.3.23",
"2018.4.20",
"2018.4.6",
"2018.5.14",
"2018.5.21",
"2018.5.22",
"2018.5.3",
"2018.6.11",
"2018.6.27",
"2018.7.15",
"2018.7.23",
"2018.8.10",
"2018.8.7",
"2018.9.1",
"2018.9.12",
"2018.9.19",
"2018.9.30",
"2019.1.13",
"2019.1.24",
"2019.10.16",
"2019.10.2",
"2019.10.3",
"2019.10.4",
"2019.11.11",
"2019.12.22",
"2019.12.3",
"2019.2.24",
"2019.2.28",
"2019.2.4",
"2019.3.13",
"2019.3.27",
"2019.4.11",
"2019.5.1",
"2019.5.28",
"2019.5.8",
"2019.6.20",
"2019.6.5",
"2019.7.2",
"2019.7.21",
"2019.7.30",
"2019.8.14",
"2019.8.23",
"2019.9.12",
"2019.9.16",
"2019.9.7",
"2019.9.8",
"2020.1.10",
"2020.1.28",
"2020.10.20",
"2020.10.9",
"2020.10.9.1",
"2020.11.11",
"2020.12.18",
"2020.12.3",
"2020.12.31",
"2020.3.13",
"2020.3.2",
"2020.4.2",
"2020.4.29",
"2020.6.8",
"2020.7.10",
"2020.7.14",
"2020.7.16",
"2020.7.18",
"2020.7.3",
"2020.8.13",
"2020.8.3",
"2020.9.14",
"2021.2.13",
"2021.2.14",
"2021.2.16",
"2021.2.8",
"2021.2.8.1",
"2021.3.3",
"2021.3.4",
"2021.3.5",
"2021.3.9",
"2022.0.0",
"2022.0.1",
"2022.0.10",
"2022.0.11",
"2022.0.12",
"2022.0.13",
"2022.0.14",
"2022.0.15",
"2022.0.16",
"2022.0.17",
"2022.0.2",
"2022.0.3",
"2022.0.4",
"2022.0.5",
"2022.0.6",
"2022.0.7",
"2022.0.8",
"2022.0.9",
"2022.1.20",
"2022.1.24",
"2022.1.8",
"2022.1.9",
"2022.10.22",
"2022.11.1",
"2022.11.7",
"2022.2.1",
"2022.2.10",
"2022.2.7",
"2022.3.22",
"2022.3.24",
"2022.3.29",
"2022.3.7",
"2022.4.19",
"2022.4.26",
"2022.5.17",
"2022.5.18",
"2022.5.18.1",
"2022.5.19",
"2022.5.26",
"2022.7.19",
"2022.7.24",
"2022.7.24.1",
"2022.7.25",
"2022.7.8",
"2022.8.23",
"2022.9.21",
"2022.9.8",
"2023.1.20",
"2023.1.30",
"2023.1.9",
"2023.10.11",
"2023.10.3",
"2023.10.4",
"2023.11.10",
"2023.11.12",
"2023.12.18",
"2023.2.22",
"2023.2.28",
"2023.3.10",
"2023.3.23",
"2023.5.10",
"2023.5.31",
"2023.5.8",
"2023.6.23",
"2023.6.28",
"2023.7.11",
"2023.7.14",
"2023.7.17",
"2023.7.20",
"2023.8.10",
"2023.9.10",
"2023.9.2",
"2023.9.25",
"2024.1.26",
"2024.1.27",
"2024.10.22",
"2024.10.25",
"2024.10.27",
"2024.10.29",
"2024.10.3",
"2024.11.13",
"2024.2.20",
"2024.2.23",
"2024.2.8",
"2024.3.1",
"2024.4.12",
"2024.4.13",
"2024.5.1",
"2024.5.31",
"2024.6.10",
"2024.6.4",
"2024.7.18",
"2024.8.8",
"2024.8.9",
"2024.9.10",
"2024.9.17",
"2024.9.17.1",
"2025.1.23",
"2025.1.24",
"2025.1.9",
"2025.2.18",
"2025.3.10",
"2025.4.10",
"2025.4.16",
"2025.4.17",
"2025.4.19",
"2025.4.20",
"2025.4.24",
"2025.5.1",
"2025.5.2",
"2025.5.28",
"2025.6.14",
"3.0.0",
"3.0.1",
"3.0.10",
"3.0.11",
"3.0.12",
"3.0.13",
"3.0.2",
"3.0.3",
"3.0.4",
"3.0.5",
"3.0.6",
"3.0.7",
"3.0.8",
"3.0.9",
"3.1.0",
"3.1.1",
"3.1.2",
"3.1.3",
"3.1.4",
"3.1.5",
"3.1.6",
"3.1.7",
"3.1.8",
"3.1.9",
"3.2.0",
"3.2.1",
"3.2.10",
"3.2.2",
"3.2.3",
"3.2.4",
"3.2.5",
"3.2.6",
"3.2.7",
"3.2.8",
"3.2.9",
"3.3.0",
"3.3.1",
"3.3.2",
"3.3.3",
"3.3.4",
"3.3.5",
"3.3.6",
"3.4.0",
"3.5.0",
"3.5.1",
"3.5.2",
"3.5.3",
"3.6.0",
"3.6.1",
"3.7.0",
"3.7.1",
"4.0.0",
"4.0.1",
"4.0.2",
"4.1.0",
"4.1.1",
"4.2.0",
"4.2.1",
"4.2.2",
"4.2.3",
"4.2.4",
"4.2.5",
"4.3.0",
"4.3.1",
"4.3.2",
"4.4.0",
"4.4.1",
"4.4.10",
"4.4.11",
"4.4.12",
"4.4.2",
"4.4.3",
"4.4.4",
"4.4.5",
"4.4.6",
"4.4.7",
"4.4.8",
"4.4.9",
"4.5.0",
"4.5.1",
"4.5.2",
"4.5.3",
"4.5.4",
"4.5.5",
"4.5.6",
"4.5.7",
"4.6.0",
"4.6.1",
"4.6.2",
"4.7.0",
"4.7.1",
"4.7.2",
"4.7.3",
"4.7.4",
"4.7.5",
"4.7.6",
"4.7.7"
]
}
],
"aliases": [
"CVE-2022-42964",
"GHSA-5jqp-885w-xj32"
],
"details": "An exponential ReDoS (Regular Expression Denial of Service) can be triggered in the pymatgen PyPI package, when an attacker is able to supply arbitrary input to the `GaussianInput.from_string` method.",
"id": "PYSEC-2026-909",
"modified": "2026-07-07T11:31:03.280865Z",
"published": "2026-07-07T10:17:23.427661Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-42964"
},
{
"type": "WEB",
"url": "https://github.com/materialsproject/pymatgen/issues/2755"
},
{
"type": "PACKAGE",
"url": "https://github.com/materialsproject/pymatgen"
},
{
"type": "WEB",
"url": "https://research.jfrog.com/vulnerabilities/pymatgen-redos-xray-257184"
},
{
"type": "PACKAGE",
"url": "https://pypi.org/project/pymatgen"
},
{
"type": "ADVISORY",
"url": "https://github.com/advisories/GHSA-5jqp-885w-xj32"
},
{
"type": "FIX",
"url": "https://github.com/materialsproject/pymatgen/pull/4476"
},
{
"type": "FIX",
"url": "https://github.com/materialsproject/pymatgen/commit/8d2ca2296109f9e5a4ac1c751eee650ab4303108"
}
],
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
],
"summary": "pymatgen is vulnerable to Regular Expression Denial of Service (ReDoS)"
}
Loading…
Loading…
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
Loading…